~ / search / GHSA-4gwv-fpmg-cmv2

GHSA-4gwv-fpmg-cmv2

Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-54003

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:simple-queue < 1.4.5 1.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission. Simple Queue Plugin 1.4.5 escapes the view name.

References

External links from the advisory. They lead to third-party sites.